No Data in Splunk App for Active Directory

[jhutto]

I recently setup a trial Splunk server in my environment, and one of the compents I would like to try is the Splunk App for Active Directory. I also installed the prerequisite apps: Sideview Utils and Windows Technology Add-on.
For data inputs, I have Splunk monitoring the remote event logs on my domain controllers as well as a base DN in Active Directory. I've let it run for almost 24 hours, but there is no data displayed in the Splunk App for Active Directory. Using the built-in Search App, I can find account lockout events, failed logins, etc., but nothing is being displayed in the AD App.
I'm pretty new to Splunk, so I'm sure it's something obvious I've overlooked.

Thanks in advance for any help you can provide.

[ahall_splunk · Accepted solution]

The Splunk App for Active Directory requires that additional technology add-ons be placed on a Universal Forwarder on your Domain Controllers. The app requires that inventory information is retrieved from each domain controller, so it doesn't work with remote collection.

See the documentation on this app at http://docs.splunk.com

[jhutto]

Thank you!

[ahall_splunk]

No. You need to install the Universal Forwarder on your Domain Controllers, configuring it to send events to your central splunk instance, and then install the Splunk_TA_windows and the appropriate Technology Add-ons in appserver/addons of the Splunk for Active Directory app.

Remote data collection is NOT supported with the Splunk for Active Directory app.

[jhutto]

So I need to install that remote collection agent on my DCs?